Loading vulnerability…
Microsoft Dynamics 365 Sales SSRF Elevation of Privilege
CVE-2025-21177 is a server-side request forgery vulnerability in Microsoft Dynamics 365 Sales. An authenticated attacker can exploit the SSRF condition over the network to cause the application to issue attacker-influenced server-side requests, resulting in elevation of privilege. Available reporting identifies the issue as affecting Microsoft Dynamics 365 Sales and classifies it as critical with a CVSS score of 8.7. Specific vulnerable functions, request paths, and internal trust-boundary details are not currently available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated remote attacker to elevate privileges within the affected Microsoft Dynamics 365 Sales environment. This can enable unauthorized access to higher-privileged application capabilities and actions that should not be available to the attacker’s original account. More granular downstream impact is not currently available.
If you can’t patch tonight, do this now.
No separate customer-side mitigation has been identified because Microsoft reported the issue as already fully mitigated in the service. As a general defensive measure, organizations should minimize privileged account exposure in Dynamics 365 Sales, review role assignments, and monitor for anomalous application behavior that could indicate abuse of server-side request functionality, but specific interim mitigations for this CVE are not currently available.
Patch, then assume compromise.
Microsoft stated that this vulnerability was fully mitigated by the vendor and that no customer action was required. Where applicable, organizations should verify that their Microsoft Dynamics 365 Sales service is operating with the vendor-provided remediation in place and follow Microsoft service health and security guidance for confirmation of mitigation status.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.